{"id":"CVE-2026-114117","summary":"Vyper 0.3.8 through 0.5.0b1 Optimizer Miscompilation of msg.value | K in Ternary Branches","details":"Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.","aliases":["GHSA-6j9c-gvcw-74fj"],"modified":"2026-10-21T10:46:32.407692959Z","published":"2026-10-21T00:37:14.741Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-682"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114117.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114117.json"},{"type":"ADVISORY","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114117"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vyperlang/vyper","events":[{"introduced":"036f153683e0d55b890305eb4c77680a0872fcba"},{"last_affected":"577d2534356903076bb79b5b15ebd4d772994693"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.3.8"},{"last_affected":"0.5.0b1"}]}]}}],"versions":["v0.5.0b1","v0.5.0a3","v0.5.0a2","v0.5.0a1","v0.4.3","v0.4.3rc1","v0.4.2","v0.4.2rc1","v0.4.1","v0.4.1rc3","v0.4.1rc2","v0.4.1rc1","v0.4.1b4","v0.4.1b3","v0.4.1b2","v0.4.1b1","v0.4.0","v0.4.0rc6","v0.4.0rc5","v0.4.0rc4","v0.4.0rc3","v0.4.0rc2","v0.4.0rc1","v0.4.0b6","v0.4.0b5","v0.4.0b4","v0.4.0b3","v0.4.0b2","v0.4.0b1","v0.3.10","v0.3.10rc5","v0.3.10rc4","v0.3.10rc3","v0.3.10rc2","v0.3.10rc1","v0.3.9","v0.3.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114117.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}